The gang that escaped with the largest cash haul in British criminal history exploited the weakest link in the security that surrounds the Securitas cash depot: its staff.

Despite the panoply of security apparatus at the depot in Tonbridge, Kent, the company accepts that its employees may always be vulnerable to attack by ruthless criminals. The gang appears to have spent some time planning the so-called tiger kidnapping which it mounted on Tuesday night, abducting the manager's wife and eight-year-old son and threatening their murder unless he cooperated in the raid, which netted up to £50m.

Adrian Leppard, assistant chief constable of Kent, said the raid had been "planned and executed with military precision", adding: "This was a terrifying crime committed by professional and organised criminals." So well planned was the raid that Kent detectives believe many people may have been involved. They are also confident they can depend upon human weakness: some at the periphery, police are convinced, will be tempted by the £2m reward offered by Securitas and its insurers.

Last night a man, 29 and a woman, 31 were being questioned after their arrests at separate addresses in Forest Hill, southeast London. Police described the arrests as significant. Officers also found a red Parcel Force van thought to have been used in one of the abductions, abandoned outside a pub in the village of Hucking, east of Maidstone. As well as those present during the operation on Tuesday night and Wednesday morning, others may have been involved in the surveillance of the depot, its manager, Colin Dixon, 51, and his home in Herne Bay, Kent.

Somebody must have obtained the gang's three vehicles and fitted one with blue flashing lights in the radiator grille to help it resemble an unmarked patrol car. The white 7.5 tonne Renault lorry that was used to take away the cash was fitted with steel cages, which may have been made or bought by somebody at the fringes of the crime.

The remote house, somewhere in the west Kent countryside, where Mr Dixon's wife, Lynn, 45, and son were held briefly on Tuesday night may have been rented by another person who could be enticed by the reward. Arrangements would have been in place to hide the raiders, dispose of the vehicles, and then launder the money. Police believe that all this leaves the gang's members as vulnerable as the depot they robbed.

One policing expert believed it was the largest reward ever offered in the UK for information about a major crime. "The tacit going rate is normally 10%, but this has not been adhered to in the largest robberies," he said. He added that Securitas staff are usually briefed about how to react if targeted in such a crime. "They would be aware they could be targets in this type of robbery," he said. "I would have thought managers would be warned that if they are flagged down they should lock all doors and refuse to get out of the car before ringing police to check out if the situation was genuine."

The money belonged to the Bank of England, and was being distributed to banking customers around the south-east. Some of the used notes were being checked to see whether they could be returned to circulation. But the Bank says the robbery will not cost the taxpayer. Under the terms of its contract, Securitas must reimburse the Bank in full, and then claim from its insurer.

It was announced yesterday night that Sir John Gieve, the deputy governor of the Bank, has been asked to conduct a review of the security of banknote storage and to make a preliminary report in two weeks.

Mr Leppard said his officers were attempting to establish whether members of the gang headed for the Channel tunnel although attempting to cross an international border so soon after a major robbery would be an unusual, high-risk tactic. His detectives could not rule out the possibility that the gang was drawing upon inside knowledge of the depot. Mr Dixon's son was said to have been particularly traumatised by the raid. He was tied up, though not gagged, and held for more than seven hours.

The gang, some wearing paintball masks and others in balaclavas, and several brandishing handguns, tied up his parents and 14 of his father's colleagues. Mr and Mrs Dixon, who also have two grown-up sons, met when they worked together in a Barclays bank in Kent. Mr Dixon is said to have worked at Securitas for a number of years. Martin Littlewood, headteacher of Herne Bay junior school, where Craig is a pupil, said he would be given "tender loving care" on his return. Mr Leppard said the gang would be captured. "We have got the skills, the determination and the resources to find them. I've got no doubt in my mind we will catch these people..." he said.